Dear Gioele, I am currently on a mission to get sssd back into Debian testing, currently blocked by: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129522 The proposed fix for the above issue involves sudo becoming the "owner" of the sudoers: entry in nsswitch.conf: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147179 The proposed fix in above bug report (adding debian/sudo.nss with below content) does fail when upgrading sudo from a version of the sudo package that did not have debian/sudo.nss, yet: ``` sudoers database-add sudoers first files ``` When installing sudo a-fresh, with above sudo.nss file, "sudoers: files" appears at the end of nsswitch.conf (GOOD). However, when upgrading from an earlier version of the sudo package, we get "sudoers:" in nsswitch.conf (BOOM). So, we end up in a broken state. The fix for this needs to be applied to dh-nss, I guess: ``` diff -Nru dh-nss-1.7.1/autoscripts/preinst-nss dh-nss-1.7.1+nmu1/autoscripts/preinst-nss --- dh-nss-1.7.1/autoscripts/preinst-nss 2026-08-20 01:17:24.000000000 +0200 +++ dh-nss-1.7.1+nmu1/autoscripts/preinst-nss 2026-09-16 16:05:08.000000000 +0200 @@ -1,4 +1,4 @@ -if [ "$1" = install ]; then +if [ "$1" = install ] || ( [ "$1" = upgrade ] && ! grep -q -E #SERVICE_PATTERNS# "${DPKG_ROOT}/etc/nsswitch.conf" ); then # Signal to postinst that the NSS services should be installed, even if the package has been removed but not purged. touch "${DPKG_ROOT}/etc/nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install" fi diff -Nru dh-nss-1.7.1/debian/changelog dh-nss-1.7.1+nmu1/debian/changelog --- dh-nss-1.7.1/debian/changelog 2026-08-20 01:17:24.000000000 +0200 +++ dh-nss-1.7.1+nmu1/debian/changelog 2026-09-16 16:05:25.000000000 +0200 @@ -1,3 +1,16 @@ +dh-nss (1.7.1+nmu1) UNRELEASED; urgency=medium + + * Non-maintainer upload. + * {autoscripts/preinst-nss,dh_installnss}: Apply .nss configs on package + upgrade, too. (Closes: -1). + - Also signal nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install + from preinst to postinst on package upgrades if SERVICE_PATTERN has not + been applied, yet. + - Assure SERVICE_PATTERN macro gets populated properly during preinst + autoscript generation. + + -- Mike Gabriel <sunweaver@debian.org> Wed, 16 Sep 2026 16:05:25 +0200 + dh-nss (1.7.1) unstable; urgency=medium * t/dh_installnss: Fix typo diff -Nru dh-nss-1.7.1/dh_installnss dh-nss-1.7.1+nmu1/dh_installnss --- dh-nss-1.7.1/dh_installnss 2026-08-20 01:17:24.000000000 +0200 +++ dh-nss-1.7.1+nmu1/dh_installnss 2026-09-16 16:05:25.000000000 +0200 @@ -405,7 +405,9 @@ my $service_patterns_expr = service_patterns_expr(\%db_services); # Add a snippet in preinst to detect installation of non-purged packages. - autoscript($package, "preinst", "preinst-nss"); + autoscript($package, "preinst", "preinst-nss", { + "SERVICE_PATTERNS" => $service_patterns_expr, + }); # Generate one snippet for each extra NSS databases to be added. foreach my $db_extra (@dbs_extra_add) { ``` Same .debdiff is attached. Please let us know if you see this as a possible fix and if you can provide this change anytime soon. Thanks, Mike (and Marc, maintainer of sudo)
Hi Gioele, hi all,
ping via BTS @ dh-nss maintainer, cross-posting to the other related
bugs affected by this, to keep other people in the loop.
People start asking about when sssd is fixed (because autofs is also
impacted by sssd not being in testing).
For the background story and how this all is related:
* autofs is not in testing, because sssd is not in testing
* sssd is not in testing because of #1129522
* to get sssd fixed (#1129522) it needs sudo bug #1147179 getting fixed
* to get the approach suggested in #1147179 fully functional dh-nss needs
love (#1148069)
* this also impact the Debian Edu 14 development, but this is not so
pressing at the moment, because we are still busy with fine-polishing
the Debian Edu 13 release
@Gioele (dh-nss maintainer): let me know if there is anything we can
do to speed up the upcoming dh-nss release. Thanks.
Cheers,
Mike
Control: tags 1148069 - patch simple fix like the one proposed here does not properly cover all the possible upgrade paths (for arbitrary changes to .nss files). Upgrades are hard. I'll try now a different strategy: making the maintscript snippets go back to a clean state before each upgrade. On paper it works, but I'm afraid it may cause intermittent issues because there will be a window of time in which the service will not be enabled in /etc/nsswitch.conf. In case of a failed upgrade that window may be arbitrarily long and if that service is something needed to log in, the admin may end up locked out of their accounts. Another option, more in line with what sssd and autofs need at the moment, would be to state something along the lines of ".nss files can only be added to or removed from a package; changing the content of .nss files between package versions is not allowed without additional ad-hoc code in maintscripts". Both options are unsatisfactory. Option 2 is perhaps the best to unblock the current sssd situation. I'll do some other testing and play with these two options during the weekend, then release a version that will at least unblock sssd. Ideas and comments are welcome!
Hi Gioele, Thanks for the info update and for providing a fix to unblock sssd. Mike
Hi Mike, On Fri, 02 Oct 2026 15:58:00 +0000 Mike Gabriel <sunweaver@debian.org> wrote: matches the reality, can you please confirm my reading of the solution you agreed upon in the other bugs? From <https://bugs.debian.org/1147179#30>: ## sudo sudoers database-add sudoers first files ## libsss-sudo Pre-Depends: sudo (>= $some-version) sudoers database-require sudoers after=files sss Regards,
Hi Gioele, Confirming! That's the proposed solution, indeed. Mike
Hi, I have uploaded dh-nss v1.8~exp2 to experimental. The new code should fix the issue that affect sssd and sudo (although many other problems are still lurking.) Please test. I'll wait for your feedback before uploading v1.8 to unstable. Regards,
Do you need that change in an experimental sudo upload? Greetings Marc
Hi Marc, For my testing, this is not needed. I am currently down with a cold, so not sure when I will get to testing this. (Not longer than beginning of next week, I hope). Mike
Hi Gioele, hi Marc,
I think we are good to go with dh-nss v1.8.
I ran various installation and upgrade tests now and v1.8 seems stable
enough to cover all upgrade/installation pathways I have tested:
* [x] neither sudo, nor libsss-sudo installed; install my sudo,
nsswitch.conf: sudoers: files
* [x] neither sudo, nor libsss-sudo installed; install both of my
package versions, nsswitch.conf: sudoers: files sss
* [x] sudo installed, upgrade to new sudo version with sudo.nss
included, nsswitch.conf: sudoers: files
* [x] sudo installed, manual change of nsswitch.conf: sudoers:
ldap, install new sudo version, nsswitch.conf: sudoers: files ldap
* [x] sudo installed, manual change of nsswitch.conf: sudoers:
ldap, install new sudo and new libsss-sudo version, nsswitch.conf:
sudoers: files ldap sss
(note, that I'll probably go with "sudoers last sss" in
libsss-sudo.nss)
* [x] sudo installed, libsss-sudo installed, upgrade to my local
pkg versions, nsswitch.conf: sudoers: files sss
* etc. (I guess I tested some more, but did not write them all down)
The .debdiffs I used:
sudo:
```
locadm@libsss-sudo-1129522:~$ debdiff sudo_1.9.17p2-9.dsc
sudo_1.9.17p2-9.1.dsc
diff -Nru sudo-1.9.17p2/debian/changelog sudo-1.9.17p2/debian/changelog
--- sudo-1.9.17p2/debian/changelog 2026-09-28 12:40:42.000000000 +0000
+++ sudo-1.9.17p2/debian/changelog 2026-10-09 05:39:58.000000000 +0000
@@ -1,3 +1,10 @@
+sudo (1.9.17p2-9.1) UNRELEASED; urgency=medium
+
+ * debian/sudo.nss:
+ + Authoritatively manage sudoers: entry in nsswitch.conf.
+
+ -- <sunweaver@debian.org> Fri, 09 Oct 2026 05:39:58 +0000
+
sudo (1.9.17p2-9) unstable; urgency=medium
* Apply upstream patches to address CVE-2026-96512.
diff -Nru sudo-1.9.17p2/debian/control sudo-1.9.17p2/debian/control
--- sudo-1.9.17p2/debian/control 2026-09-28 12:40:42.000000000 +0000
+++ sudo-1.9.17p2/debian/control 2026-10-09 05:39:58.000000000 +0000
@@ -10,6 +10,7 @@
Build-Depends:
debhelper-compat (= 13),
dh-sequence-installnss,
+ dh-nss (>= 1.8~),
Build-Depends-Arch:
autoconf,
bison,
diff -Nru sudo-1.9.17p2/debian/sudo.nss sudo-1.9.17p2/debian/sudo.nss
--- sudo-1.9.17p2/debian/sudo.nss 1970-01-01 00:00:00.000000000 +0000
+++ sudo-1.9.17p2/debian/sudo.nss 2026-09-09 20:34:35.000000000 +0000
@@ -0,0 +1,3 @@
+sudoers database-add
+
+sudoers first files
```
sssd:
```
locadm@libsss-sudo-1129522:~$ debdiff sssd_2.13.1-3.dsc sssd_2.13.1-3.1.dsc
diff -Nru sssd-2.13.1/debian/changelog sssd-2.13.1/debian/changelog
--- sssd-2.13.1/debian/changelog 2026-09-08 11:05:35.000000000 +0000
+++ sssd-2.13.1/debian/changelog 2026-10-09 04:20:16.000000000 +0000
@@ -1,3 +1,15 @@
+sssd (2.13.1-3.1) UNRELEASED; urgency=medium
+
+ * Rebuild against dh-nss 1.8~.
+ * debian/libsss-sudo:
+ + Adjust rules, expect sudo bin:pkg to own the sudoers: entry in
+ nsswitch.conf.
+ * debian/patches:
+ + Add gdm-51-pam-extension-macros-compat.patch. Fix building against
+ libgdm-dev (>= 51).
+
+ -- <sunweaver@debian.org> Fri, 09 Oct 2026 04:20:16 +0000
+
sssd (2.13.1-3) unstable; urgency=medium
* debian/tests/control: Explicitly have tests requiring
openssh-client depend
diff -Nru sssd-2.13.1/debian/control sssd-2.13.1/debian/control
--- sssd-2.13.1/debian/control 2026-09-08 11:05:33.000000000 +0000
+++ sssd-2.13.1/debian/control 2026-10-09 04:20:16.000000000 +0000
@@ -12,6 +12,7 @@
dh-apparmor,
dh-python,
dh-sequence-installnss,
+ dh-nss (>= 1.8~),
bind9-dnsutils,
docbook-xml,
docbook-xsl,
@@ -372,6 +373,7 @@
Package: libsss-sudo
Section: libs
Architecture: any
+Pre-Depends: ${misc:Pre-Depends}, sudo (>= 1.9.17p2-9.1~)
Depends: ${misc:Depends}, ${shlibs:Depends}
Description: Communicator library for sudo
Utility library to allow communication between sudo and SSSD for caching
diff -Nru sssd-2.13.1/debian/libsss-sudo.nss
sssd-2.13.1/debian/libsss-sudo.nss
--- sssd-2.13.1/debian/libsss-sudo.nss 2026-09-08 11:05:33.000000000 +0000
+++ sssd-2.13.1/debian/libsss-sudo.nss 2026-10-09 04:20:16.000000000 +0000
@@ -1,3 +1,3 @@
-sudoers database-add
+sudoers database-require
sudoers last sss
diff -Nru
sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch
sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch
---
sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch 1970-01-01
00:00:00.000000000 +0000
+++
sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch 2026-10-09
04:20:16.000000000 +0000
@@ -0,0 +1,54 @@
+Description: Fix FTBFS with GDM 51 PAM extension headers
+ GDM 51 rewrote its gdm-pam-extensions headers, replacing the uppercase
+ function-like macros with static inline functions.
+Author: Renan Rodrigo <rr@ubuntu.com>
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/2163336
+Forwarded: https://github.com/SSSD/sssd/pull/9076
+Last-Update: 2026-08-12
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+Index: sssd-2.13.1/src/sss_client/pam_sss.c
+===================================================================
+--- sssd-2.13.1.orig/src/sss_client/pam_sss.c
++++ sssd-2.13.1/src/sss_client/pam_sss.c
+@@ -67,6 +67,40 @@
+ #endif
+ #endif /* HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION */
+
++/* GDM 51 replaced the uppercase function-like macros of its PAM extension
++ * headers with lowercase static inline functions. Provide the old macro
++ * names as aliases so the code below keeps compiling with both old and new
++ * gdm-pam-extensions. */
++#ifdef HAVE_GDM_PAM_EXTENSIONS
++#ifndef GDM_PAM_EXTENSION_SUPPORTED
++#define GDM_PAM_EXTENSION_SUPPORTED(name) \
++ gdm_pam_extension_supported(name)
++#endif
++#ifndef GDM_PAM_EXTENSION_MESSAGE_TO_BINARY_PROMPT_MESSAGE
++#define
GDM_PAM_EXTENSION_MESSAGE_TO_BINARY_PROMPT_MESSAGE(extended_message,
binary_message) \
++
gdm_pam_extension_message_to_binary_prompt_message((GdmPamExtensionMessage
*)(extended_message), binary_message)
++#endif
++#ifndef GDM_PAM_EXTENSION_CHOICE_LIST_REQUEST_INIT
++#define GDM_PAM_EXTENSION_CHOICE_LIST_REQUEST_INIT(request, title,
num_items) \
++ gdm_pam_extension_choice_list_request_init(request, title, num_items)
++#endif
++#ifndef GDM_PAM_EXTENSION_REPLY_TO_CHOICE_LIST_RESPONSE
++#define GDM_PAM_EXTENSION_REPLY_TO_CHOICE_LIST_RESPONSE(reply) \
++ gdm_pam_extension_reply_to_choice_list_response(reply)
++#endif
++#endif /* HAVE_GDM_PAM_EXTENSIONS */
++
++#ifdef HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION
++#ifndef GDM_PAM_EXTENSION_CUSTOM_JSON_REQUEST_INIT
++#define GDM_PAM_EXTENSION_CUSTOM_JSON_REQUEST_INIT(request,
proto_name, proto_version, json_str) \
++ gdm_pam_extension_custom_json_request_init(request, proto_name,
proto_version, json_str)
++#endif
++#ifndef GDM_PAM_EXTENSION_REPLY_TO_CUSTOM_JSON_RESPONSE
++#define GDM_PAM_EXTENSION_REPLY_TO_CUSTOM_JSON_RESPONSE(reply) \
++ gdm_pam_extension_reply_to_custom_json_response(reply)
++#endif
++#endif /* HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION */
++
+ #include "sss_pam_compat.h"
+ #include "sss_pam_macros.h"
+
diff -Nru sssd-2.13.1/debian/patches/series sssd-2.13.1/debian/patches/series
--- sssd-2.13.1/debian/patches/series 2026-09-08 11:05:33.000000000 +0000
+++ sssd-2.13.1/debian/patches/series 2026-10-09 04:20:16.000000000 +0000
@@ -9,3 +9,4 @@
CVE-2026-68742.diff
CVE-2026-68743.diff
CVE-2026-68744.diff
+gdm-51-pam-extension-macros-compat.patch
```
Greets,
Mike
We believe that the bug you reported is fixed in the latest version of
dh-nss, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1148069@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Gioele Barabucci <gioele@debian.org> (supplier of updated dh-nss package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 11 Oct 2026 20:48:01 +0200
Source: dh-nss
Architecture: source
Version: 1.8
Distribution: unstable
Urgency: medium
Maintainer: Gioele Barabucci <gioele@debian.org>
Changed-By: Gioele Barabucci <gioele@debian.org>
Closes: 1148069
Changes:
dh-nss (1.8) unstable; urgency=medium
.
* autoscripts: Add basic support for installing NSS services during package upgrades
(Closes: #1148069)
* Makefile: Add `test` target
* t/dh_installnss:
- Test multiple installation scenarios for each subtest
- Add test infrastructure for package upgrades
- Add first tests for upgrades
- Add tests for moving databases across packages
* d/t/doc-example: Fix test by properly modifying nsswitch.conf
* d/gbp.conf: Use default `debian-tag`
Checksums-Sha1:
1c15988b4de59bdc3c23ce0aa8754f91f8cbb1f9 1898 dh-nss_1.8.dsc
51020273fa5b4cf3c93b9181a45820b809d8b949 16524 dh-nss_1.8.tar.xz
80fce7c5b59e0527e03434a7062a4599d0a42ea4 32304 dh-nss_1.8.git.tar.xz
98f7783f84120cedf9c472cf014d65773ce430da 17704 dh-nss_1.8_source.buildinfo
Checksums-Sha256:
a10b2141ce8b2060cd194b9eb10f4087c9cdadf20f25e9d67f4953ffb1cb601e 1898 dh-nss_1.8.dsc
5eb08ba6b7d27b4d7f87be34097cb4c5c2be752ed9cce93c0b651570b816f341 16524 dh-nss_1.8.tar.xz
3b3454d91a2c5623b711ef4dd9abdcff8066c05f86fb26fcc0d7343d32d17132 32304 dh-nss_1.8.git.tar.xz
f3dee94cd0278bd1fbbeaa17ffbeec00c8cd06893909e63efd9cf818adc44eb7 17704 dh-nss_1.8_source.buildinfo
Files:
5fecd60ce2cb2a4ad1c0ffa15387057e 1898 devel optional dh-nss_1.8.dsc
7e07172c103b3180c460422b0c1b10d9 16524 devel optional dh-nss_1.8.tar.xz
617b1d20a9b20915ac7e4e81b9202c93 32304 devel None dh-nss_1.8.git.tar.xz
fc6096017b753cb3f64fafc1efa8ec1f 17704 devel optional dh-nss_1.8_source.buildinfo
Git-Tag-Info: tag=c735d2aa5ab0488884e481a935bf4fc2b82c3aa1 fp=02988a8f528fa493e1b98e388f89871cdb75972e
Git-Tag-Tagger: Gioele Barabucci <gioele@debian.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrL2xQACgkQYG0ITkaD
wHlVcw/+O+Ab4XCiJjzOyzYAOOlotXbsK3EqRbU2w6hZUdBgdhdFWNJJ9WPvANsV
ZUgBPF5dCubuzeA8vqNwUywATyRplUC8pdg+gNB1yIWDM6nFSYDirKtEV+WqFcpy
GgjUQApMLm2ZWmvICqyb/o9QCC/dxv79bH3XTU8EY52D+Xkrx+7MJsK16PtumSVk
U4jx5PoCUkhNIALG5XDBCoRm1lolwB83lZwQV6oS15IJqhUxu8Pv5Uq6z++1vrM7
GSJ0KGmayDSF+/nuW8ftMw+smByWOAtPPdI3f74JvtvpJsWcQvPrK+iu1ZLQaEku
BL/ZrZc5n32CfYuzsA4slEdiwgaiUHD/XhkBspDO8yX4NCzCw/8n+kk9LprurA1K
BbEnTHZXP/5esNcDQKPuU/5MiPsjr6YnhqTUs/DJjqsH0665Uwzy1sYHCvIXAmQm
H3ydJII3fh5zk66vPwoDj2t1JFmMApmnDqJoC0SF+RsvNA0qTFL0D9Mt5pT8bb5u
YOcULw1xhIbRpPbmogvY/cg+tQuVJMh6m9hsghP/NnYtbrfN8nfeAoPuMcDcFIrK
+2xAYY8/ehgJy4vLVh1B6w1haFaYGnknPJ5pI+KMNSWMH23PEPmGeavZRhtPbra7
caz638DTzB8EUJdd/OrmPgzhykN5hmdQVNxV9C3SF5LnPDvEZLQ=
=m+2R
-----END PGP SIGNATURE-----
Hi Mike, On Fri, 09 Oct 2026 06:21:06 +0000 Mike Gabriel <sunweaver@debian.org> wrote: Thanks Mike, also for the initial bug report and patch. I have released v1.8 with the fix. Regards,
Hi Gioele, hi Marc, thanks for the upload, Gioele. @Marc: Your turn regarding sudo... Mike
Will do, hopefully later this week. I apologize for being unresponsive. Greetings Marc
What exactly am I supposed to do? Which files does sudo have to put where? I am sorry for having lost context. Greetings Marc